T09 · Insecure Skill Coding Practices
Error
- Location
projects.json:2- Finding
Live Feishu Application Credential Committed in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
Beijing Signed Price Tracker
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its housing-tracker purpose, but it ships a real Feishu credential and an under-documented monitor that can send local OpenClaw run-log details to Feishu.
Review before installing. Do not use this package as-is with the bundled Feishu configuration: the app secret should be revoked, removed from the artifact, and supplied only through protected configuration. The cron-run monitor should be removed or made explicit opt-in with a user-controlled path, recipient, and redacted payloads. Project URL fetching should be restricted to the intended Beijing Housing Commission host, and users should understand that housing data, cache-derived room details, and run notifications are sent to Feishu.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/monitor-tracker-runs.js:9- Finding
Undocumented Collection and External Transmission of OpenClaw Cron-Run Data
- Content
View full analysis
line.trim()) .filter(Boolean) .map(line => JSON.parse(line)); } ``` The latest run's error or summary is placed into a message: ```js function buildStatusText(_today, latestRun) { const time = formatShanghaiDateTime(Number(latestRun?.runAtMs || latestRun?.ts || 0)); const status = String(latestRun?.status || 'unknown'); const detail = String(latestRun?.error || latestRun?.summary || '无详细信息'); const title = status.toLowerCase() === 'ok' ? '北京签约跟踪最新状态' : '北京签约跟踪执行告警'; return [ title, `最近一次执行时间：${time}`, `状态：${status}`, `详情：${detail}` ].join('\n'); } ``` The resulting content is transmitted to a configured Feishu recipient: ```js async function main() { const config = readJson(CONFIG_PATH); const feishu = config?.feishu || {}; if (!feishu.appId || !feishu.appSecret || !feishu.notifyUserOpenId) { throw new Error('projects.json 缺少飞书告警所需配置（appId/appSecret/notifyUserOpenId）'); } const today = getTodayShanghai(); const entries = readJsonLines(RUNS_PATH); const latestRun = getLatestFinishedRun(entries); if (!latestRun) { console.log(JSON.stringify({ ok: true, notified: f ...[truncated 3139 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tracker.js:247- Finding
Unrestricted Project URL Fetching Permits Server-Side Request Forgery
- Content
View full analysis
controller.abort(), 25000); try { const response = await fetch(url, { redirect: 'follow', signal: controller.signal, ...options, headers: { 'user-agent': 'Mozilla/5.0 (OpenClaw Skill Tracker)', ...(options.headers || {}) } }); const text = await response.text(); if (!response.ok) throw new Error(`HTTP ${response.status}`); clearTimeout(timeout); return text; } catch (error) { clearTimeout(timeout); lastError = error; if (attempt < retries) await new Promise(resolve => setTimeout(resolve, attempt * 1500)); } } throw lastError; } ``` Project URLs are stored without protocol, host, port, or path validation: ```js if (command === 'add') { if (!options.name || !options.url) throw new Error('add 命令需要同时提供 --name 和 --url'); const project = upsertProject(config, options.name, options.url); saveConfig(configPath, config); console.log(`已保存项目映射: ${project.name} (${project.urls.length} 个链接)`); console.log(`配置文件: ${configPath}`); return; } ``` A temporary URL can also be supplied directly to synchronization: ```js let projectsToSync = []; if (options.name && options.url) projectsToSync = [{ name: options.name, url: options.url }]; else if (options ...[truncated 3565 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A severe description-behavior mismatch is a strong trust violation: the skill claims to scrape housing data and update a spreadsheet, but the analysis indicates different behavior centered on local cron-run data and Feishu notifications. Such mismatches can conceal unauthorized data access or exfiltration because users approve one purpose while the skill executes another.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用 `scripts/tracker.js` 维护多个地块名到北京住建委项目详情链接的映射，并把新发现的“已签约 / 网上联机备案”房屋写入**飞书表格**。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises behavior that requires network access and use of secrets from environment/config, but it does not declare any explicit tool scope or permission boundaries. In an agent setting, missing scope declarations can cause overbroad execution or user surprise about external access and secret usage, especially since the skill performs outbound requests and messaging.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly persists data locally, writes to a remote Feishu spreadsheet, and sends automatic DMs, but it does not clearly warn users that project data will be stored and transmitted off-system. This creates privacy, compliance, and operational risks because users may invoke the skill without understanding retention and disclosure effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script automatically sends the latest run status and detail text to a Feishu user, and that detail is derived from
latestRun.errororlatestRun.summarywithout any filtering or minimization. If those fields contain sensitive operational data, stack traces, internal paths, project identifiers, or other unintended content from the run log, the script will exfiltrate that information to an external messaging channel as part of normal operation.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Most of the natural-language documentation and operational instructions are presented only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This file is a JSON file, so vague-trigger checks apply. The content is purely operational state and does not document any activation phrases, scope limits, or exclusion conditions, so if this file is being used as a manifest/config for the skill, trigger specificity is missing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The project names and URLs indicate this skill is configured specifically for Chinese-language, Beijing-region project data, but the file provides no natural-language indication that this locale constraint is optional or user-selected. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy concern when the configuration implicitly restricts operation to one locale.
- Content